# cve.now: Gradio-app

The newest entries naming Gradio-app as an affected vendor (up to 200), of 50 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-59806](https://cve.now/CVE-2026-59806.md): Gradio \< 6.20.0 - Open Redirect and SSRF via /gradio\_api/file= endpoint (CVSS 4.9)
- [CVE-2026-49119](https://cve.now/CVE-2026-49119.md): Gradio \< 6.16.0 Path Traversal via FileExplorer.preprocess() (CVSS 8.7)
- [CVE-2026-10783](https://cve.now/CVE-2026-10783.md): gradio-app gradio Audio Cache Key save\_audio\_to\_cache weak hash (CVSS 2.0)
- [CVE-2026-48545](https://cve.now/CVE-2026-48545.md): Gradio \< 6.15.0 Cookie Injection via Shared Proxy Client (CVSS 7.6)
- [CVE-2026-28416](https://cve.now/CVE-2026-28416.md): Gradio has SSRF via Malicious \`proxy\_url\` Injection in \`gr.load()\` Config Processing (CVSS 8.2)
- [CVE-2026-28415](https://cve.now/CVE-2026-28415.md): Gradio has Open Redirect in OAuth Flow (CVSS 4.3)
- [CVE-2026-28414](https://cve.now/CVE-2026-28414.md): Gradio has Absolute Path Traversal on Windows with Python 3.13+ (CVSS 7.5)
- [CVE-2026-27167](https://cve.now/CVE-2026-27167.md): Gradio: Mocked OAuth Login Exposes Server Credentials and Uses Hardcoded Session Secret (CVSS 0.0)
- [CVE-2025-48889](https://cve.now/CVE-2025-48889.md): Gradio Allows Unauthorized File Copy via Path Manipulation (CVSS 5.3)
- [CVE-2025-5320](https://cve.now/CVE-2025-5320.md): gradio-app gradio CORS is\_valid\_origin privilege escalation (CVSS 6.3)
- [CVE-2024-8021](https://cve.now/CVE-2024-8021.md): Open Redirect in gradio-app/gradio (CVSS 5.4)
- [CVE-2024-10648](https://cve.now/CVE-2024-10648.md): Path Traversal in gradio-app/gradio (CVSS 8.2)
- [CVE-2024-12217](https://cve.now/CVE-2024-12217.md): Path Traversal in gradio-app/gradio (CVSS 5.3)
- [CVE-2024-8966](https://cve.now/CVE-2024-8966.md): Denial of Service in gradio-app/gradio (CVSS 7.5)
- [CVE-2024-10569](https://cve.now/CVE-2024-10569.md): Zip Bomb Vulnerability in gradio-app/gradio (CVSS 7.5)
- [CVE-2024-10624](https://cve.now/CVE-2024-10624.md): Regular Expression Denial of Service (ReDoS) in gradio-app/gradio (CVSS 7.5)
- [CVE-2025-0187](https://cve.now/CVE-2025-0187.md): Denial of Service (DoS) by Sending Large Filename at File Upload Endpoint in gradio-app/gradio (CVSS 7.5)
- [CVE-2025-23042](https://cve.now/CVE-2025-23042.md): Gradio Blocked Path ACL Bypass Vulnerability (CVSS 8.7)
- [CVE-2024-51751](https://cve.now/CVE-2024-51751.md): Arbitrary file read with File and UploadButton components in Gradio (CVSS 6.5)
- [CVE-2024-47867](https://cve.now/CVE-2024-47867.md): Lack of integrity check on the downloaded FRP client in Gradio (CVSS 2.1)
- [CVE-2024-47868](https://cve.now/CVE-2024-47868.md): Several components’ post-process steps may allow arbitrary file leaks in Gradio (CVSS 6.3)
- [CVE-2024-47869](https://cve.now/CVE-2024-47869.md): Non-constant-time comparison when comparing hashes in Gradio (CVSS 2.3)
- [CVE-2024-47870](https://cve.now/CVE-2024-47870.md): Race condition in update\_root\_in\_config may redirect user traffic in Gradio (CVSS 7.1)
- [CVE-2024-47871](https://cve.now/CVE-2024-47871.md): Insecure communication between the FRP client and server in Gradio (CVSS 8.2)
- [CVE-2024-47872](https://cve.now/CVE-2024-47872.md): Cross-site Scripting on Gradio server via upload of HTML files, JS files, or SVG files (CVSS 6.9)
- [CVE-2024-47084](https://cve.now/CVE-2024-47084.md): CORS origin validation is not performed when the request has a cookie in Gradio (CVSS 6.9)
- [CVE-2024-47164](https://cve.now/CVE-2024-47164.md): The \`is\_in\_or\_equal\` function may be bypassed in Gradio (CVSS 2.3)
- [CVE-2024-47165](https://cve.now/CVE-2024-47165.md): CORS origin validation accepts the null origin in Gradio (CVSS 6.9)
- [CVE-2024-47166](https://cve.now/CVE-2024-47166.md): One-level read path traversal in \`/custom\_component\` in Gradio (CVSS 2.3)
- [CVE-2024-47167](https://cve.now/CVE-2024-47167.md): SSRF in the path parameter of /queue/join in Gradio (CVSS 6.9)
- [CVE-2024-47168](https://cve.now/CVE-2024-47168.md): The \`enable\_monitoring\` flag set to \`False\` does not disable monitoring in Gradio (CVSS 2.3)
- [CVE-2024-4940](https://cve.now/CVE-2024-4940.md): Open Redirect in gradio-app/gradio (CVSS 5.4)
- [CVE-2024-4325](https://cve.now/CVE-2024-4325.md): Server-Side Request Forgery (SSRF) in gradio-app/gradio (CVSS 8.6)
- [CVE-2024-4941](https://cve.now/CVE-2024-4941.md): Local File Inclusion in JSON component in gradio-app/gradio (CVSS 7.5)
- [CVE-2024-4254](https://cve.now/CVE-2024-4254.md): Secrets Exfiltration in gradio-app/gradio (CVSS 7.1)
- [CVE-2024-4253](https://cve.now/CVE-2024-4253.md): Command Injection in gradio-app/gradio (CVSS 7.5)
- [CVE-2024-1561](https://cve.now/CVE-2024-1561.md): Arbitrary Local File Read via Component Method Invocation in gradio-app/gradio (CVSS 7.5)
- [CVE-2024-1183](https://cve.now/CVE-2024-1183.md): SSRF Vulnerability in gradio-app/gradio (CVSS 6.5)
- [CVE-2024-1728](https://cve.now/CVE-2024-1728.md): Local File Inclusion in gradio-app/gradio (CVSS 7.5)
- [CVE-2024-1729](https://cve.now/CVE-2024-1729.md): Timing Attack Vulnerability in gradio-app/gradio (CVSS 5.9)
- [CVE-2024-1540](https://cve.now/CVE-2024-1540.md): Command Injection in gradio-app/gradio via deploy+test-visual.yml workflow (CVSS 8.6)
- [CVE-2024-2206](https://cve.now/CVE-2024-2206.md): SSRF Vulnerability in gradio-app/gradio (CVSS 7.3)
- [CVE-2024-1727](https://cve.now/CVE-2024-1727.md): CSRF Vulnerability in gradio-app/gradio (CVSS 4.3)
- [CVE-2024-0964](https://cve.now/CVE-2024-0964.md): LFI in Gradio (CVSS 7.5)
- [CVE-2023-51449](https://cve.now/CVE-2023-51449.md): Make the \`/file\` secure against file traversal attacks (CVSS 5.6)
- [CVE-2023-6572](https://cve.now/CVE-2023-6572.md): Command Injection in gradio-app/gradio (CVSS 9.6)
- [CVE-2023-34239](https://cve.now/CVE-2023-34239.md): Unfiltered paths in gradio (CVSS 7.3)
- [CVE-2023-25823](https://cve.now/CVE-2023-25823.md): Gradio contains Use of Hard-coded Credentials (CVSS 5.4)
- [CVE-2022-24770](https://cve.now/CVE-2022-24770.md): Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging (CVSS 8.8)
- [CVE-2021-43831](https://cve.now/CVE-2021-43831.md): Files on the host computer can be accessed from the Gradio interface (CVSS 7.7)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/gradio-app
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.